CISA Known Exploited Vulnerabilities
KEV additions — January 2026
16 CVEs entered the KEV catalog in January 2026.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added January 29, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | 9.8 | 98.7 % | Feb 1, 2026 |
Added January 27, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-24858 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | 9.8 | 85.8 % | Jan 30, 2026 |
Added January 26, 20265
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2018-14634 | Linux Kernel Integer Overflow Vulnerability | 7.8 | 14.7 % | Feb 16, 2026 |
| CVE-2025-52691 | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability | 10 | 85.7 % | Feb 16, 2026 |
| CVE-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | 7.8 | 70.8 % | Feb 16, 2026 |
| CVE-2026-23760 | SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API | 9.8 | 96.4 % | Feb 16, 2026 |
| CVE-2026-24061 | GNU InetUtils Argument Injection Vulnerability | 9.8 | 99.0 % | Feb 16, 2026 |
Added January 23, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-37079 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | 9.8 | 22.4 % | Feb 13, 2026 |
Added January 22, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-31125 | Vite Vitejs Improper Access Control Vulnerability | 7.5 | 65.2 % | Feb 12, 2026 |
| CVE-2025-34026 | Versa Concerto Actuator Authentication Bypass Information Leak | 7.5 | 81.8 % | Feb 12, 2026 |
| CVE-2025-54313 | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability | 7.5 | 4.9 % | Feb 12, 2026 |
| CVE-2025-68645 | Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability | 8.8 | 48.9 % | Feb 12, 2026 |
Added January 21, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-20045 | Cisco Unified Communications Products Remote Code Execution Vulnerability | 8.2 | 4.5 % | Feb 11, 2026 |
Added January 13, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-20805 | Desktop Window Manager Information Disclosure Vulnerability | 5.5 | 7.5 % | Feb 3, 2026 |
Added January 12, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-8110 | Gogs Path Traversal Vulnerability | 8.8 | 85.2 % | Feb 2, 2026 |
Added January 7, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-37164 | Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability | 9.8 | 90.2 % | Jan 28, 2026 |